Popular AI Library Ultralytics YOLO11 Compromised in Supply Chain Attack

Supply Chain Attack Targets Popular AI Library

Ultralytics YOLO11, a widely-used open-source AI model for computer vision and object detection, fell victim to a sophisticated supply chain attack. The compromise affected versions 8.3.41 and 8.3.42 of the library, which were uploaded to the Python Package Index (PyPI), one of the world's largest Python package repositories 1

1

.

Impact and Scope of the Attack

The attack's impact was significant due to YOLO11's popularity. The library boasts over 30,000 stars on GitHub, has been forked more than 6,000 times, and sees hundreds of thousands of downloads daily 1

1

. Users who updated to the compromised versions, either directly or through dependencies like SwarmUI and ComfyUI, inadvertently installed a cryptocurrency miner on their devices 2

2

.

Malware Details and Functionality

The malware deployed was XMRig, a popular cryptojacker known for mining Monero (XMR), a privacy-oriented cryptocurrency that is difficult to trace 1

1

. When installed, the compromised library would launch the XMRig Miner, connecting to a mining pool at "connect.consrensys[.]com:8080" 2

2

.

Attack Vector and Sophistication

The attack exploited a vulnerability in the Ultralytics build environment. According to ReversingLabs researcher Karlo Zanki, the intrusion was achieved through a "known GitHub Actions Script Injection" vulnerability 3

3

. This allowed the attacker to insert unauthorized modifications after the code review step, creating a discrepancy between the source code on GitHub and the package published on PyPI.

Response and Mitigation

Ultralytics founder and CEO Glenn Jocher confirmed the attack and stated that the compromised versions were immediately removed from PyPI. A new version, 8.3.43, was released to address the security issue 2

2

. The company is conducting a full security audit and implementing additional safeguards to prevent similar incidents in the future.

Ongoing Concerns and Recommendations

Despite the initial response, there were reports of newer versions (8.3.45 and 8.3.46) also being "trojanized" 1

1

. Users are advised to update to the latest clean version and perform a full system scan out of an abundance of caution. The incident highlights the potential risks in the AI supply chain, as more aggressive malware like backdoors or remote access trojans (RATs) could have been deployed instead of a cryptocurrency miner 3

3

.